CVE-2026-45013 describes an improper input validation vulnerability (CWE-20) in ApostropheCMS (product apostrophe) versions <=4.29.0. The password reset flow constructs the reset URL using req.hostname, which is derived from the HTTP Host header controlled by the attacker if apos.baseUrl is not explicitly set. This allows an unauthenticated attacker who knows a victim's email to send a reset request that results in the victim receiving a reset link pointing to the attacker's domain. When the victim clicks the link, the attacker obtains the valid reset token, enabling full account takeover. There is no known patch or official fix available at the time of publication.

The vulnerability allows an unauthenticated attacker to perform account takeover by tricking victims into clicking a password reset link that points to a malicious domain controlled by the attacker. This leads to compromise of the victim's account without requiring authentication. The CVSS 3.1 score is 8.1 (high), reflecting the network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality and integrity impact.

As of the time of this report, no official patch or fix is available. Users should explicitly configure apos.baseUrl to a trusted value to prevent the application from using the attacker-controlled Host header when constructing reset URLs. Monitor vendor advisories for updates and patches addressing this issue.